Operational Risk Management Questions

Identifying, assessing, and reducing operational risk before it becomes an incident. Covers operational risk categories (process, people, supplier, technology, execution), surfacing the risks in a large program such as a cloud migration, risk registers and ownership cadence, likelihood and impact scoring (heat maps, qualitative vs quantitative, expected loss, ranges and Monte Carlo, estimating with little history), scenario analysis and structured failure-mode review before a risky change, key risk indicators and early-warning signals, risk response strategies (avoid, reduce, transfer, accept) including contracts and insurance for supplier exposure, prioritizing mitigations by expected loss and cost per unit of risk reduced, residual risk reporting and escalation to leadership, key-person risk and single points of failure, risk appetite and risk-versus-speed trade-offs, systemic and recurring risk including human error, the three lines model (formerly three lines of defense), and building organizational resilience (resilience metrics, resilience testing programs, culture). Proactive risk reduction, not reactive incident handling. Disaster recovery and continuity planning, incident command, vendor due diligence, security and privacy risk, and project schedule risk are covered elsewhere.